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Abstract. Powerful skew arithmetic circuits are introduced. These are skew arith¬ 
metic circuits with variables, where input gates can be labelled with powers 
for binary encoded numbers n. It is shown that polynomial identity testing for 
powerful skew arithmetic circuits belongs to coRNC^, which generalizes a cor¬ 
responding result for (standard) skew circuits. Two applications of this result are 
presented: (i) Equivalence of higher-dimensional straight-line programs can be 
tested in coRNC^; this result is even new in the one-dimensional case, where the 
straight-line programs produce strings, (ii) The compressed word problem (or cir¬ 
cuit evaluation problem) for certain wreath products of finitely generated abelian 
groups belongs to coRNC^. 


1 Introduction 

Polynomial identity testing is the following computational problem: The input is a cir¬ 
cuit, whose internal gates are labelled with either addition or multiplication and its 
input gates are labelled with variables {xi,X 2 , ■ ■ ■) or constants (—1, 0,1), and it is 
asked whether the output gate evaluates to the zero polynomial (in this paper, we al¬ 
ways work in the polynomial ring over the coefficient ring Z or for n > 2). Based 
on the Schwartz-Zippel-DeMillo-Lipton Lemma, Ibarra and Moran IfT^ proved that 
polynomial identity testing over Z or Zp belongs to the class CORP (the complements 
of problems in randomized polynomial time). Whether there is a deterministic polyno¬ 
mial time algorithm for polynomial identity testing is an important problem. In ifTSll it 
is shown that if there exists a language in DTIME(2®*^”^) that has circuit complexity 
2^("\ then P = BPP (and hence P = RP = coRP). There is also an implication that 
goes the other way round: Kabanets and Impagliazzo Cl proved that if polynomial 
identity testing belongs to P, then (i) there is a language in NEXPTIME that does not 
have polynomial size circuits, or (ii) the permanent is not computable by polynomial 
size arithmetic circuits. Both conclusions represent major open problems in complexity 
theory. Hence, although it is quite plausible that polynomial identity testing belongs to 
P (by d), it will be probably very hard to prove (by Cl)- 

It is known that for algebraic formulas (where the circuit is a tree) and more gen¬ 
erally, skew circuits (where for every multiplication gate, one of the two input gates is 
a constant or a variable), polynomial identity testing belongs to coRNC (but it is still 
not known to be in P), see llT4l Corollary 2.1]. This holds, since algebraic formulas and 
skew circuits can be evaluated in NC if the variables are substituted by concrete (binary 


coded) numbers. Then, as for general polynomial identity testing, the Schwartz-Zippel- 
DeMillo-Lipton Lemma yields a coRNC-algorithm. 

In this paper, we identify a larger class of circuits, for which polynomial identity 
testing is still in coRNC; we call these circuits powerful skew circuits. In such a circuit, 
we require that for every multiplication gate, one of the two input gates is either a con¬ 
stant or a power of a variable x, where the exponent N is given in binary notation. 
One can replace this power x^ by a subcircuit of size log N using iterated squaring, but 
the resulting circuit is no longer skew. The main result of this paper states that polyno¬ 
mial identity testing for powerful skew circuits over the rings Z[a;] and Fp[a;] is still in 
coRNC (in fact, coRNC^). For this, we use an identity testing algorithm of Agrawal and 
Biswas H], which computes the output polynomial of the circuit modulo a polynomial 
p{x) of polynomially bounded degree, which is randomly chosen from a certain sample 
space. Moreover, in our application, all computations can be done in the ring Fp[a;] for 
a prime number p of polynomial size. This allows us to compute the big powers x^ 
modulo p{x) in NC^ using an algorithm of Fich and Tompa HI. It should be noted that 
the application of the Agrawal-Biswas algorithm is crucial in our situation. If, instead 
we would use the Schwartz-Zippel-DeMillo-Lipton Lemma, then we would be forced 
to compute mod m for randomly chosen numbers a and m with polynomially 
many bits. Whether this problem (modular powering) belongs to NC is a famous open 
problem 13 Problem B.5.6]. 

We present two applications of our coRNC identity testing algorithm. The first one 
concerns the equivalence problem for straight-line programs. Here, a straight-line pro¬ 
gram (SLP) is a context-free grammar G that computes a single word val(G'). In this 
context, SLPs are extensively used in data compression and algorithmics on compressed 
data, see iflTll for an overview. It is known that equivalence for SLPs, i.e., the question 
whether val(G') = val(iT) for two given SLPs, can be decided in polynomial time. This 
result was independently discovered by Hirshfeld, Jerrum, and Moller ifTTIl . Mehlhorn, 
Sundar, and Uhrig ll2Tll . and Plandowski ||22l. All known algorithms for the equivalence 
test are sequential and it is not clear how to parallelize them. Here, we exhibit an NC^- 
reduction from the equivalence problem for SLPs to identity testing for skew powerful 
circuits. Hence, equivalence for SLPs belongs to coRNC. Moreover, our reduction im¬ 
mediately generalizes to higher dimensional pictures for which SLPs can be defined in a 
fashion similar to the one-dimensional (string) case, using one concatenation operation 
in each dimension. For two-dimensional SLPs, Berman et al. ||4) proved that equiva¬ 
lence belongs to coRP using a reduction to PIT. We can improve this result to coRNC. 
Whether equivalence of two-dimensional (resp., one-dimensional) SLPs belongs to P 
(resp., NC) is open. 

Our second application concerns the compressed word problem for groups. Let G 
be a finitely generated (f.g.) group, and let L" be a finite generating set for G. For the 
compressed word problem for G, briefly CWP(G), the input is an SLP (as described in 
the preceding paragraph) over the alphabet S U and it is asked whether val(G) 
evaluates to the group identity. The compressed word problem is a succinct version 
of the classical word problem (Does a given word over S U evaluate to the group 
identity?). One of the main motivations for the compressed word problem is the fact that 
the classical word problem for certain groups (automorphism groups, group extensions) 
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can be reduced to the compressed word problem for simpler groups IfTSl Section 4.2]. 
For finite groups (and monoids) the compressed word problem was studied in Beaudry 
et al. im, and for infinite groups the problem was studied for the first time in ifTbl . 
Subsequently, several important classes of f.g. groups with polynomial time compressed 
word problems were found; f.g. nilpotent groups, f.g. free groups, graph groups (also 
known as right-angled Artin groups or partially commutative groups), and virtually 
special groups. The latter contain all Coxeter groups, one-relator groups with torsion, 
fully residually free groups, and fundamental groups of hyperbolic 3-manifolds; see 
ifTSll for details. For the important class of f.g. linear groups, i.e., f.g. groups of matrices 
over a field, one can show that the compressed word problem reduces to polynomial 
identity testing (over Z or Zp, depending on the characteristic of the field) and hence 
belongs to coRP ITS] Theorem 4.15]. Vice versa, it was shown that polynomial identity 
testing over Z can be reduced to the compressed word problem for the linear group 
SL 3 (Z) ifTSi Theorem 4.16]. The proof is based on a construction of Ben-Or and Cleve 
0. This result indicates that derandomizing the compressed word problem for a f.g. 
linear group will be in general very difficult. 

In this paper, we consider the compressed word problem for wreath products. If G 
is a f.g. non-abelian group, then the compressed word problem for the wreath product 
G i Z is coNP-hard ITSl Theorem4.21]. On the other hand, we prove that CWP(Z I Z) 
is equivalent w.r.t. NC^-reductions to identity testing for powerful skew circuits. In 
particular, CWP(Z I Z) belongs to coRNC. The latter result generalizes to any wreath 
product G I H, where iF = Z" for some n and G is a finite direct product of copies of 
Z and Zp for primes p. 


2 Background from complexity theory 


Recall that RP is the set of all problems A for which there exists a polynomial time 
bounded randomized Turing machine R such that: (i) if x G A then R accepts x with 
probability at least 1 /2, and (ii) if x ^ A then R accepts x with probability 0. The class 
coRP is the class of all complements of problems from RP. 

We use standard definitions concerning circuit complexity, see e.g. Il2^ for more 
details. In particular we will consider the class NC* of all problems that can be solved 
by a circuit family (C„)„>i, where the size of C„ (the circuit for length-n inputs) is 
polynomially bounded in n, its depth is bounded by 0(log* n), and C„ is built from 
input gates, NOT-gates and AND-gates and OR-gates of fan-in two. The class NC is 
the union of all classes NC*. All circuit families in this paper will be logspace-uniform, 
which means that the mapping a" can be computed in logspace. A few times, we 

will mention the class DLOGTIME-uniform TC°, see lITOl for details. Flere, it is only 
important that DLOGTIME-uniform TC° is contained in NC^. 

To define a randomized version of NC*, one uses circuit families with additional 
inputs. So, let the n* circuit Cn in the family have n normal input gates plus m random 
input gates, where m is polynomially bounded in n. For an input x G {0,1}** one 
defines the acceptance probability as 


Prob[C„ accepts x] 


\{yG{0,ir\Cn{x,y) = l}\ 

2m 
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Here, C„(x, y) = 1 means that the circuit evaluates to 1 if the normal input gate 
gets the i* bit of the input string x, and the i* random input gate gets the ** bit of the 
random string y. Then, the class RNC* is the class of all problems A for which there 
exists a polynomial size circuit family (C„)„>o of depth 0(log* n) with random input 
gates that uses NOT-gates and AND-gates and OR-gates of fan-in two, such that for all 
inputs X G {0,1}* of length n: (i) if x G A, then Prob[C„ accepts x] > 1/2, and (ii) if 
X ^ A, then Prob[C„ accepts a:] = 0. As usual, coRNC* is the class of all complements 
of problems from RNC*. Section B.9 in ||9l contains several problems that are known 
to be in RNC, but which are not known to be in NC; the most prominent example is the 
existence of a perfect matching in a graph. 


3 Polynomials and circuits 

n this paper we deal with polynomial rings R\xi,..., Xk] in several variables, where R 
is the ring of integers Z or the ring Z„ of integers modulo n > 2. For computational 
problems, we have to distinguish between two representations of polynomials. Let 

i 

p{xi, ..., Xfc) = ^ aixl'-^ • ■ • xl'-'‘ 
i=l 


be a multivariate polynomial. 

- The standard representation of p{x) is the sequence of tuples (a^, ..., Ci^k), 

where the coefficient Oi is represented in binary notation (of course this is only 
important for the coefficient ring Z) and the exponents j are represented in unary 
notation. Let \p\ = I]/=i(riog loil] + Ci.i H-h 

- The succinct representation of p{x) is the sequence of tuples (a^, Cip ,..., 

where both the coefficient Oi and the exponents are represented in binary nota¬ 
tion. Let IpI = E"=i(riog|«*n + riogei,i] H-h [logei,*]). 

We use the following result of Eberly Q (see also Qol). 

Proposition 1. Iterated addition, iterated multiplication, and division with remainder 
of polynomials from Z [x] or Fp [x] (pis a prime that can be part of the input in binary en¬ 
coding) that are given in standard representation belong to NC^ (in fact, DLOGTIME- 
uniform T C^). 

Consider a commutative semiring S = (S, ©, ©). An algebraic circuit (or just circuit) 
over iS is a triple C = {V, rhs, Aq), where L is a hnite set of gates or variables, Aq G V 
is the output gate, and rhs (for right-hand side) maps every A C L to an expression (the 
right-hand side of A) of one of the following three forms: 

- a semiring element s G S (such a gate is an input gate), 

- B (B C with B,C gV (such a gate is an addition gate), 

- B ® C with B,C GV (such a gate is a multiplication gate). 
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Moreover, we require that the directed graph 

graph(C) = {V, {(A, B) gV xV \ B occurs in rhs(A)}) 

is acyclic. Every gate A G V evaluates to an element vale (^) S S' in the natural way 
and we set val(C) = valc(^o)- A circuit over S is called skew if for every multiplication 
gate A one of the two gates (or both of them) in rhs(A) is an input gate. 

A branching program over S is a tuple A = (V, E, X, s, t), where (V, E) is a di¬ 
rected acyclic graph, X : E ^ S assigns to each edge a semiring element, and s,t & V. 
Let V be the set of all paths from s to t. For a path p = (vo,vi, ... ,Vn) G V (vq = s, 
Vn = t) we dehne A(p) = nT^i the product (w.r.t. (8>) of all edge labels 

along the path. Finally, the value dehned by A is 

val(,4) = X{p). 

P^V 

It is well known that skew circuits and branching programs are basically the same ob¬ 
jects. 

It is well known that the value dehned by a branching program A can be computed 
using matrix powers. W.l.o.g. assume that A = ({1,..., n}, E, X, 1, n) and consider 
the adjacency matrix M of the edge-labelled graph ({!,..., n}, E, A), i.e., the (n x n)- 
matrix M with M[i,j] = X{i,j)- Then 


val(^) = 



For many semirings S, this simple fact can be used to get an NC^-algorithm for com¬ 
puting val(^). The n + 1 matrix powers (0 < i < n) can be computed in parallel, 
and every power can be computed by a balanced tree of height log i < log n, where 
every tree node computes a matrix product. Hence, we obtain an NC^-algorithm, if 

(i) the number of bits needed to represent a matrix entry in M" is polynomially 
bounded in n and the number of bits of the entries in M, and 

(ii) the product of two matrices over the semiring <S can be computed in NC^. 

Point (ii) holds if products of two elements and iterated sums in S can be computed 
in NC^. For the following important semirings these facts are well known (see also 
Proposition [T]l; (Z„[x],-f, •) for n > 2, (Z U {cxd}, min,-f), and (Z U 

{—oo}, max, -f). Here, we assume that polynomials are given in the standard repre¬ 
sentation. For the polynomial ring Z[x] also note that every entry p{x) of the matrix 
power M" is a polynomial of degree n • m, where m is the maximal degree of a poly¬ 
nomial in M, and all coefficients are bounded by (n • m • a)" (and hence need at most 
n ■ (log n -f log m -f log n) bits), where a is the maximal absolute value of a coefficient 
in M. Hence point (i) above holds. The following lemma sums up the above discussion. 

Lemma 1. The output value of a given skew circuit (or branching program) over one 
of the following semirings can be computed in NC^.' 
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(i) +, •) and +, •) for n > 2 (polynomials are given in the standard 

representation, and n can be part of the input in binary representation) 

(ii) (Z U {oo}, min, +) and (Z U {—oo}, max, +) (integers are given in binary rep¬ 
resentation) 

Point (i) of Lemma [T] also holds for the polynomial rings (Z[xi,..., Xk], +, ■) and 
(Z„[xi,..., Xfc], +, •) as long as the number k of variables is not part of the input: 
The polynomial p(xi ,... ,Xk) = + 1) be defined by a branching program 

with 0{k) edges labeled by the polynomials Xi +1, but the product of these polynomials 
has 2^ monomials. Also note that it is important that we use the standard representation 
for polynomials in (i): The polynomial p{x) = 0^1 be represented by a 

branching program with 0{n) edges labeled by the polynomials + 1 but p{x) has 
2" monomials. 

In this paper, we will mainly deal with circuits overapolynomialringi?[xi,... ,Xfc], 
where the ring R is either (Z, +, •) or (Z„, +, •). Let R be one of these rings. By defini¬ 
tion, in such a circuit every input gate is labelled with a polynomial from i?[xi,... ,Xfc]. 
Usually, one considers circuits where the right-hand side of an input gate is a polyno¬ 
mial given in standard representation (or, equivalently, a constant a & R or variable 
Xi); we will also use the term “standard circuits” in this case. For succinctness reasons, 
we will also consider circuits over i?[xi,..., Xfe], where the right-hand sides of input 
gates are polynomials given in succinct representation. For general circuits this makes 
no real difference (since a big power x^ can be defined by a subcircuit of size 0(log N) 
using iterated squaring), but for skew circuits we will gain additional succinctness. We 
will use the term “powerful skew circuits”. Formally, a powerful skew circuit over the 
polynomial ring R\xi ,■■■, Xk] is a skew circuit over the ring i?[xi,..., x^] as defined 
above, where the right-hand side of every input gate is a polynomial that is given in 
succinct representation (equivalently, we could require that the right-hand side is a con¬ 
stant a € R or a power xf with N given in binary notation). We define the size of a 
powerful skew circuit C as follows: First, define the size sizec(A) of a gate A G U as 
follows: If A is an addition gate or a multiplication gate, then sizec(A) = 1, and if A is 
an input gate with rhs(A) = p(xi,..., Xk), then sizec(A) = ||p(xi,..., Xk)\\- Finally, 
we define the size of C as sizec(A). 

A powerful branching program is an algebraic branching program (V,E,X,s,t) 
over a polynomial ring i?[xi,..., Xk], where every edge label A(e) (e G i?) is a polyno¬ 
mial that is given in succinct representation. The size of a powerful branching program 
is III - From a given powerful skew circuit one can compute in logspace an 

equivalent powerful branching program and vice versa. 

Note that the transformation of a powerful skew circuit over i?[xi,..., x^] into an 
equivalent standard skew circuit (where every input gate is labelled by a polynomial 
given in standard representation) requires an exponential blow-up. For instance, the 
smallest standard skew circuit for the polynomial x^ has size N, whereas x^ can be 
trivially obtained by a powerful skew circuit of size [log W]. 

A central computational problem in computational algebra is polynomial identity 
testing, briefly PIT. Let ii be a ring that is effective in the sense that elements of R 
can be encoded by natural numbers in such a way that addition and multiplication in R 
become computable operations. Then, PIT for the ring R is the following problem: 
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Input: A number k>l and a circuit C over the ring R\xi ,..., Xk\- 
Question: Is val(C) the zero-polynomial? 

For the rings Z and Zp {p prime) the following result was shown in ifT^ : for Z„ with n 
composite, it was shown in ifTl . 

Theorem 1. For each of the rings Z and Z„ fn > 2), PIT belongs to the class coRP. 

Note that the number k of variables is part of the input in PIT. On the other hand, 
there is a well-known reduction from PIT to PIT restricted to univariate polynomials 
(polynomials with a single variable) IT]. For a multivariate polynomial p{xi,... ,Xk) G 
R[xi,..., Xk] let degj(p) be the degree of p in the variable Xi. It is the largest number 
d such that xf appears in a monomial of p. Let p{xi ,..., Xfc) be a polynomial and let 
d = 1 -f max{degj(p) | 1 < i < k}. We dehne the univariate polynomial U{p) as 

U{p)=p{y\y^...y"-"). 

Hence, the polynomial U (p) is obtained from p{xi,... ,Xk)i>y replacing every mono¬ 
mial a ■ • • • x"'' by a ■ y^, where N = ni + n 2 d + ■ ■ ■ nkd^~^ is the number with 

base-d representation (ni, 77 , 2 ,... ,nk). The polynomial p is the zero-polynomial if and 
only if U(p) is the zero-polynomial. 

The following lemma can be also shown for arbitrary circuits, but we will only need 
it for powerful skew circuits. 

Lemma 2. Given a powerful skew circuit C for the polynomial p(xi ,... ,Xk), the fol¬ 
lowing can be be computed in NC^.‘ 

(i) The binary encoding of d = 1 -f max{degj(p) \1 < i < k} and 

(ii) a powerful skew circuit C for U (p). 

Proof Let C be a powerful skew circuit for the polynomial p(xi,..., x/c). In order to 
compute degj(p), we construct a circuit over the max-plus semiring as follows: Take 
the circuit C. If A is an input gate that is labelled with the polynomial a(xi,..., Xk), 
then relabel A with the binary coded number degj(a). Moreover, for a gate A with 
rhs(A) = B C (resp., rhs(A) = B x C) we set rhs(A) = max{B, C) (resp., 
rhs(A) = B -\- C). The resulting circuit is clearly skew. Therefore it can be evaluated 
in NC^ by Lemma[T] 

Once the number d = 1 -f max{degj(p) | 1 < i < fc} is computed we simply 
replace every monomial a ■ x"^ • • • x^*" in the circuit C by the monomial a ■ y^, where 
N = ni n 2 d -j- ■ ■ ■ nkd’^~^. The binary encoding of N can be computed from the 
binary encodings of ni ,... ,nk even in DLOGTIME-uniform TC°. □ 

Note that the above reduction from multivariate to univariate circuits does not work for 
standard skew circuits: the output circuit will be powerful skew even if the input circuit 

tt/c 

is standard skew. For instance, the polynomial Xi (which can be produced by a 
standard skew circuit of size k) is transformed into the polynomial for which the 

smallest standard skew circuit has size f2(2*). 
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4 PIT for powerful skew circuits 

The main result of this paper is: 

Theorem 2. For each of the rings Z and Fp fp is a prime that can be part of the input 
in unary encoding), PIT for powerful skew circuits belongs to the class coRNC^. 

The proof of Theorem |2] has two main ingredients: The randomized identity testing 
algorithm of Agrawal and Biswas [I] and the modular polynomial powering algorithm 
of Fitch and Tompa lO. Let us start with the identity testing algorithm of Agrawal and 
Biswas. We will only need the version for the polynomial ring Fp [x], where p is a prime 
number. 

Consider a polynomial P{x) S Fp[x] of degree d. The algorithm of Agrawal and 
Biswas consists of the following steps (later we will apply this algorithm to the polyno¬ 
mial defined by a powerful skew circuit), where 0 < e < 1 is an error parameter: 

1. Let be a number with I > log d and t = max{^, ^ } 

2. Find the smallest prime number r such that r f p and r does not divide any of 
p — 1, p^ — 1,... ,p^“^ — 1. It is argued in IT] that r S 0{i‘^ logp). 

3. Randomly choose a tuple b = {bo,..., &f_i) € {0,1}^ and compute the poly¬ 
nomial Tr,b,t{x) = Qr{Ab,t{x)), where Qr{x) = the r* cyclotomic 

polynomial and Af, t(x) = x* +eLo 

4. Accept, if P{x) mod Tr^b,t{x) = 0, otherwise reject. 

Clearly, if P{x) = 0, then the above algorithm accepts with probability 1. For a non¬ 
zero polynomial P{x), Agrawal and Biswas proved: 

Theorems (Ill). Let P{x) G Fp[x] be a non-zero polynomial of degree d. The above 
algorithm rejects P{x) with probability at least e. 

The second result we are using was shown by Fich and Tompa: 

Theorem 4 (I8l). The following computation can be done in NC^.' 

Input: A unary encoded prime number p, polynomials a{x),q{x) G Fp[x] such that 
deg(a(x)) < deg(g(x)) = d, and a binary encoded number N. 

Output: The polynomial a{x)^ mod q{x). 

Remark 1. In ii, it is stated that the problem can be solved using circuits of depth 
(logn)^ log log n for the more general case that the underlying field is Fp«, where p 
and I are given in unary representation. The main bottleneck is the computation of an 
iterated matrix product A 1 A 2 ■ ■ • Am (for m polynomial in the input length) of (d x d)- 
matrices over the field Fp«. In our situation (where the field is Fp) we easily obtain an 
NC^-algorithm for this step: Two {d x d)-matrices over Fp can be multiplied in NC^ 
(actually in DLOGTIM E-uniform TC°). Then we compute the product Ai A 2 ■ • ■ Am by 
a balanced binary tree of depth log m. Also logspace-uniformity of the circuits is not 
stated explicitly in fS], but follows easily since only standard arithmetical operations on 
binary coded numbers are used. 
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Proof of Theorem^ By Lemma |2 we can restrict to univariate polynomials. We first 
prove the theorem for the case of a powerful skew circuit C over the held Fp, where the 
prime number p is part of the input but specihed in unary notation. 

Let p be a unary encoded prime number and A= ({!,..., n}, 1, n, A) be a power¬ 
ful branching program with n nodes that is equivalent to C. Let P{x) = va I (^) € Fp [cc]. 
Fix an error probability 0 < e < 1. Our randomized NC^-algorithm is based on 
the identity testing algorithm of Agrawal and Biswas. It accepts with probability 1 if 
val(^) = 0 and accepts with probability at most e if P{x) f 0. Let us go through 
the four steps of the Agrawal-Biswas algorithm to see that they can be implemented in 

NCl 

Step 1. An upper bound on the degree of P{x) can be computed in NC^ as in the proof 
of Lemma For the number £ we can take the number of bits of this degree bound, 
which is polynomial in the input size. Let t = max{£, ^}. 

Step 2. For the prime number r we know that r £ OiP' logp), which is a polynomial 
bound. Hence, we can test in parallel all possible candidates for r. For a certain can¬ 
didate r, we check in parallel whether it is prime (recall that r is of polynomial size) 
and whether it divides any of the numbers p — 1, — 1,... ,p^~^ — 1. The whole 

computation is possible in NC^. 

Step 3. Let b — {bo, ■ ■ ■, bi-i) £ {0,1}^ be the chosen tuple. We have to compute 
the polynomial Tr^b,t{x) = Qr{Ab,t{x)), where Qr{x) = X]i=o ^f>,t — x*^ + 

Si=o ■ 2;*. This is an instance of iterated multiplication (for the powers Ab^tixf) and 
iterated addition of polynomials. Hence, by Proposition [T] also this step can be carried 
out in NC^. Note that the degree of Tr^b,t{x) is f • (r — 1), i.e., polynomial in the input 
size. 

Step 4. For the last step, we have to compute P{x) mod Tr^b,t{x). For this, we consider 
in parallel all monomials a ■ x^ that occur in an edge label of our powerful algebraic 
branching program A. Recall that a £ Fp and N is given in binary notation. Using the 
Fich-Tompa algorithm we compute x^ mod Tr^b,t{x) (with a{x) = x) in NC^. We then 
replace the edge label a ■ x^ by a ■ {x^ mod Tr^b,t{x)). Let B the resulting algebraic 
branching program. Every polynomial that appears as an edge label in B is now given 
in standard form. Hence, by Lemma [T] we can compute in NC^ the output polynomial 
val(S). Clearly, P{x) mod Tr^b,tix) = val(6) mod Tj.^b,t{x). The latter polynomial can 
be computed in NC^ by Proposition [1] 

Let us now prove Theorem |2] for the ring Z. Let A = ({1,..., n}, 1, n, A) be a 
powerful algebraic branching program over Z with n nodes and let P{x) = val(^). 
Let us hrst look at the coefficients of P{x). Let m be the maximum absolute value |a|, 
where a ■ x^ is an edge label of A. Since there are at most 2” many paths from s to f in 
A, every coefficient of the polynomial P{x) belongs to the interval [—(2m)”, (2m)"]. 
Let k = n ■ ([log(m)] -I- 1) + 1 and pi,... ,pk be the first k prime numbers. Each 
prime pi is polynomially bounded in k (and hence the input size) and the list of primes 
can be computed in NC^ by doing in parallel all necessary divisibility checks on unary 
encoded numbers. 

The Chinese remainder theorem implies that P{x) = 0 if and only if P{x) = 
0 mod Pi for all 1 < i < fc. We can carry out the latter tests in parallel using the 
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above algorithm for a unary encoded prime number. The overall algorithm accepts if 
we accept for every prime pi. If P{x) = 0, then we will accept for every 1 < z < fc 
with probability 1, hence the overall algorithm accepts with probability 1. On the other 
hand, if P{x) ^ 0, then there exists a prime Pi {\ < i < k) such that the algorithm 
rejects with probability at least 1 — e. Hence, the overall algorithm will reject with 
probability at least 1 — e as well. □ 

5 Multi-dimensional straight-line programs 

Let L be a finite alphabet. For / G N let [Z] = {1,..., / }. An n-dimensional picture 
over L is a mappings : 0^=1 [^i] ^ ^ for some Ij G N. Let dom(p) = 0^=1 [^f]- For 
1 < j < n wt define \p\j = Ij as the length of p in the dimension. Note that one¬ 
dimensional pictures are simply finite words. Let P* denote the set of n-dimensional 
pictures over P. On this set we can define partially defined concatenation operations Oj 
(1 < z < n) as follows: For pictures p,q € P*, the picture po^qis defined if and only if 
\p\j = Igljforalll <j < n with z 7 ^ j. In this case, we have \pOiq\j = \p\j {= |g|j)for 
j ^ zand \po,q\, = \p\i + \q\i.Letlj = \po,q\j. Fora tuple {ki,... ,kn) G we 

finally set {po, q){ki, ...,kn)= piki ,... ,fc„) if fc* < \p\, and {po, q){ki, ...,kn) = 
q{ki ,..., ki-i,ki — \p\i, h+i,..., kn) if h > \p\i. These operations generalize the 
concatenation of finite words. 

An n-dimensional straight-line program (SLP) over the terminal alphabet L is a 
triple A = {V, rhs, S), where L is a finite set of variables. S' G L is the start variable, 
and rhs maps each variable A to its right-hand side rhs(A), which is either a terminal 
symbol a G A or an expression of the form B Oj C, where B,C € V and 1 < z < rz 
such that the following additional conditions are satisfied: 

- The relation {(A, B) G V x V \ A occurs in rhs(A)} is acyclic. 

- One can assign to each A G V and 1 < z < rz a number \A\i with the following 
properties: If rhs(A) G P then \A\i = 1 for all z. If rhs(A) = B o^C then \A\i = 
\B\i -F \C\^ and \ A\j = \B\j = \Cj \ for all j 7 ^ z. 

These conditions ensure that every variable A evaluates to a unique rz-dimensional pic¬ 
ture valA(A) such that |valA(A)|j = \ A\i for all 1 < z < rz. Finally, val(A) = valA(S) 
is the picture defined by A. We omit the index A if the underlying SLP is clear from the 
context. We define the size of the SLP A = {V, P, S, P) as |A| = \V\. 

A one-dimensional SLP is a context-free grammar that generates a single word. 
Two-dimensional SLPs were studied in m. 

A simple induction shows that for every rz-dimensional SLP A of size m and every 
1 < z < rz one has |val(A)|i < 0(3"*''^^) 15] proof of Lemma 1]. On the other hand, 
it is straightforward to define an SLP B of size rzz such that |val(B)|i = 2™ for all 
dimensions z. Hence, an SLP can be seen as a compressed representation of the picture 
it generates, and exponential compression rates can be achieved in this way. 

5.1 Equality testing for compressed strings and n-dimensional pictures 

Given two rz-dimensional SLPs we want to know whether they evaluate to the same 
picture. In ID it was shown that this problem belongs to coRP by translating it to poly- 


10 


nomial identity testing. For a given n-dimensional picture p : dom(p) —)• {0,1} we 
define the polynomial 

n 

fp{xi,...,Xn) = ^ p(ei,...,e„)]^xf. 

{ei,... ,en) Edom(23) *=1 

We consider fp as a polynomial from Z 2 [a;i,..., x„]. For two n-dimensional pictures 
p and q such that \p\i = \q\i for all 1 < f < n we clearly have p = q if and only if 
fp + fq = 0 (recall that coefficients are from Z 2 ). In ||4], it was observed that from an 
SLP A for a picture P, one can easily construct an arithmetic circuit for the polynomial 
fp, which leads to a coRP-algorithm for equality testing. Since the circuit for fp is 
actually powerful skew, we get; 

Theorem 5. The question whether two n-dimensional SLPs A and B evaluate to the 
same n-dimensional picture is in coRNC^ (here, n is part of the input). 

Proof. Let Ai = (Vi, rhsi, iSi) and A 2 = (V 2 , rhs 2 , S 2 ) be n-dimensional SLPs over 
the alphabet P. We can assume that Vi H V 2 = 0 and P = {0,1} (if P = {ai,..., a^} 
then we encode Oi by 0 * 1 *“®). 

First we calculate \A\i for every 1 < fc < n and every A € Vi U V 2 in NC^ by 
evaluating additive circuits over N, see Lemma[T] If |S'i|i 7 ^ 1521 ^ for some 1 < fc < n, 
then we have val(Ai) ^ val(A 2 ). Otherwise, we construct the circuit 

C = (Fi U F2 U {5}, rhs, S) 

over Z 2 [a;i,..., a;„] with: 

rhsc(A) = B -t- ■ C if rhsi(A) = i? oj. C or rhs 2 (A) = B OkC, 

rhsc(A) = a if rhsi(yl) = a £ {0,1} or rhs 2 (A) = a € {0,1}, and 

rhs{S) = Si+S 2 

Then val(C) = /vai(Ai) + /vai(A 2 ) so val(C) = 0 if and only if val(Ai) = val(A 2 ). 
Obviously C becomes a powerful skew circuit after splitting right-hand sides of the form 
B -+- x^ ■ C. Hence, Theorem|2] allows to check in coRNC^ whether val(C) =0. □ 

It should be noted that even in the one-dimensional case (where equality testing for 
SLPs can be done in polynomial time 01 1I21I22I 1. no randomized NC-algorithm was 
known before. 

6 Circuits over wreath products 

As a second application of identity testing for powerful skew circuits we will consider 
the circuit evaluation problem (also known as the compressed word problem) for wreath 
products of finitely generated abelian groups. The wreath product is an important op¬ 
eration in group theory. The next subsection briefly recalls the definition and some 
well-known results. We assume some basic familiarity with group theory. 
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6.1 Wreath products 

Let G and H be groups. The restricted wreath product H iG is defined as follows: 

- Elements of HlG are pairs (/, g), where g € G and f : G ^ H is a mapping such 
that /(a) 7 ^ 1h for only finitely many a G G {1h is the identity element of H). 

- The multiplication in H I G is defined as follows: Let {fi,gi), (72, 52 ) G H I G. 
Then (/i, pi)(/ 2 , 92 ) = if, 9192 ), where /(a) = /i(a)/ 2 (prV). 

For readers, who have not seen this definition before, the following intuition might be 
helpful: An element (/, 5 ) G HlG can be thought as a finite collection of elements of H 
that are sitting in certain elements of G (the mapping /) together with a distinguished 
element of G (the element g), which can be thought as a cursor moving around G. 
If we want to compute the product {fi, gi){f 2 , 92 ), we do this as follows: First, we 
shift the finite collection of iJ-elements that corresponds to the mapping /2 by gi: If 
the element h G H \ {l/r} is sitting in a € G (i.e., / 2 (a) = h), then we remove h 
from a and put it to the new location gia G G. This new collection corresponds to 
the mapping f 2 { 9 i^o)- After this shift, we multiply the two collections of 

7J-elements pointwise: If in a G G the elements hi and /12 are sitting (i.e., /i(a) = hi 
and / 2 (a) = ^ 2 ), then we put the product / 11/12 into the G-location a. Finally, the new 
distinguished G-element (the new cursor position) becomes gig 2 - 
The following lemma seems to be folklore. 

Lemma 3. The group (A x B) iG embeds into (AlG) x (B I G). 

Proof. Let -ka '■ A x B ^ Ahs the natural projection morphism and similarly for 
ttb ■ A X B ^ B. We define an embedding (p : {A x B) I G ^ {Al G) x (B I G) hy 

Pif,9)= ^(/°7rA,p),(/o7rB,5) 

Clearly, (p is injective. Moreover, it is easy to see that pis a group homomorphism. □ 

A proof of the following simple lemma can be found for instance in lfT9l . 

Lemma 4. Let K be a subgroup of H of finite index m and let G be a group. Then 
G™ I K is isomorphic to a subgroup of index min G I H. 

6.2 Compressed word problems 

Let G be a finitely generated group and let 27 be a finite generating set for G, i.e., every 
element of G can be written as a finite product of elements from 27 and inverses of 
elements from 27. Let L = 27 U {a“^ | a G 27}. For a word w G B* we write w = 1 
in G if and only if the word w evaluates to the identity of G. The word problem for 
G asks, whether w = 1 in G for a given input word. There exist finitely generated 
groups and in fact finitely presented groups (groups that are defined by finitely many 
defining relations) with an undecidable word problem. Here, we are interested in the 
compressed word problem for a finitely generated group. For this, the input word w is 
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given in compressed form by a one-dimensional SLP as defined in Section|5] Recall that 
a one-dimensional picture over an alphabet F is simply a finite word over F. Hence, 
val(A) is a word if A is a one-dimensional SLR In the following we always mean one¬ 
dimensional SLPs when using the term SLP. The compressed word problem for G asks, 
whether val(A) = 1 in G for a given SLP A. 

The compressed word problem is related to the classical word problem. For in¬ 
stance, the classical word problem for a f.g. subgroup of the automorphism group of 
a group G can be reduced to the compressed word problem for G, and similar results 
are known for certain group extensions, see ifTSl for more details. Groups, for which 
the compressed word problem can be solved in polynomial time are m- finite groups, 
f.g. nilpotent groups, f.g. free groups, graph groups (also known as right-angled Artin 
groups or partially commutative groups), and virtually special groups, which are groups 
that have a finite index subgroup that embeds into a graph group. The latter groups form 
a rather large class that include for instance Coxeter groups, one-relator groups with 
torsion, residually free groups, and fundamental groups of hyperbolic 3-manifolds. In 
||2| the parallel complexity of the compressed word problem (there, called the circuit 
evaluation problem) for finite groups was studied, and the following result was shown; 

Theorem 6 (O). Let G be a finite group. If G is solvable, then CWP(G) belongs to 
the class NC^. IfG is not solvable, then CWP(G) is P-complete. 

The following two results are proven in ifTSl . 

Theorem 7 (Theorem 4.15 in lITSl ). For every f.g. linear group the compressed word 
problem belongs to the class coRP. 

This result is shown by reducing the compressed word problem for a f.g. linear group 
to polynomial identity testing for the ring Z. Also a kind of converse of Theorem |2]is 
shown in ifTSi : 

Theorem 8 (Theorem 4.16 in lUSll ). The problem CWP(SL 3 (Z)) and polynomial iden¬ 
tity testing for the ring Z are polynomial time reducible to each other. 

This result is shown by using the construction of Ben-Or and Cleve a for simulating 
arithmetic circuits by matrix products. 

Finally, the following result was recently shown in ES; it generalizes Theorem |6] 

Theorem 9 ( Ifisl ). Let G be a f.g. group having a normal subgroup H such that FI is 
f.g. nilpotent and the quotient group G / H is finite solvable. Then CWP(G) G NC^. 

To the knowledge of the author, there is no example of a group G not having the prop¬ 
erties from Theorem|9l for which CWP(G) belongs to NC. 

6.3 CWP(Z I If) and identity testing for powerful skew circuits 

In this section, we explore the relationship between the compressed word problem for 
the wreath product Z I Z and polynomial identity testing for powerful skew circuits. We 
show that these two problems are equivalent w.r.t. NC^-reductions. 
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Let C? = Z; Z. We consider the generators a and t of G, where t (resp., a) generates 
the Z on the left (resp., right). So, with a (resp., a“^) we move the cursor to the left 
(resp., right) and with t (resp., we add one (resp., subtract one) from the value at 
the current cursor position. Let F = {a, t, 

For a word w € F* we define A{w) = |r(;|a — Irula-i € The word w is positive 
if A{u) > 0 for every prefix m of w that ends with t or The word w is well- 
formed, if it is positive and A{w) = 0. If ru is positive and {f,g) € G is a group 
element represented by the word w, then f{x) f Q implies that a; S N (intuitively, the 
Z-generator t or its inverse is never added to a position outside of N). If in addition w 
is well-formed then g = Q. For a given positive word w € F* we define a polynomial 
Pw{x) € Z[a;] inductively as follows: 

- Pe{x) = 0. 

- If zu = ua or ly = ua~^, then Pw{x) = Pu{x). 

- If ru = ut^ with 6 € {1, —1}, thenpu,(a:) = Pu{x) 5 ■ x‘^, where d = A{w) = 
A{u). 

If the positive word w represents the group element (/, g) € G, then the polynomial 
Pw{x) encodes the mapping / in the following sense: The coefficient of the monomial 
x® in pw{x) is exactly /(e). In particular, the following equivalence holds for every 
positive word w € F*: 


ui = 1 in G O {pw{x) = 0 and A{w) = 0) 

Lemma 5. From a given SLP A over the alphabet F one can compute in NC^ a pow¬ 
erful skew circuit C such that val(C) = Pw{x), where w = val(A) a~^ and k = 
|val(A)|. In particular, val(A) = lin G if and only //(val(C) = 0 and Zl(val(A)) = 0). 

Proof Let k = |val(A)|. Our construction is divided into the following two steps: 

Step 1. Using iterated squaring, we add further nonterminals to A such that val(Afe) = 
and val(A^^) = a~^ for distinguished non-terminals Ak and Af^. Then, we define 
the SLP B by defining rhsB(A) = Akt^Af^ for every variable A with rhsA(A) = 

{5 € {—1, !})■ All other right-hand sides of A are left unchanged. Then, val(B) = 
a* val(A) in G. 

Let B = (y, rhsB, S) for the further consideration. Note that for every A G V, 
the word vuIb (A) is positive. Hence, for every A G V we can define the polynomial 
Pa{x) := Pvai(A)(2:). Moreover, let = Z\(val(A)) G Z; these numbers can be 
computed by an additive circuit in NC^, see Lemma[T] 

For every A G U let 

TTiA = min({Z\(zt) | zt is a prefix of val(A) that ends with t or 

where we set min(0) = 0. Since val(A) is positive, we have > 0. The polynomial 
Pa(x) can be uniquely written as 

Pa{.x) = x"^^ ■ QAix), 
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for a polynomial qA{x). The numbers niA can be computed in NC^, using the following 
identity, where a{A) denotes the set of symbols occurring in valB(^)- 


rriA 


{ 0 if rhsB(^) = 

k if vhsK{A) = Akt^ 

minjmB, ds + me} if rhsB(^) = BC and a{C) fl {f, t~^} ^ 0 

ms if rhsB(^) = BC and a{C) fl {f, = 0 


Note that these rules define a skew circuit in the semiring (Z U {cxd}, min, +). Hence, 
by Lemma[T]the circuit can be evaluated in NC^. 

Step 2. We now construct a circuit C such that for every A & V 'Nt have; 

vale (A) = qA{x). 


We dehne the rules of the circuit C as follows; 

- If rhsB(^) = for <5 G {—1,1}, then we set rhsc(^) = 0. 

- If rhsB(^) = Akt^A^^ for S € {—1,1}, then we set rhsc(^) = <5- 

- If rhsB(A) = BC and a(C) fl {t, = 0, then we set rhsc(^) = B. 

- If rhsB(^) = BC and a(C') fl {t, ^ 0, then = minims, ds + me} and 

we set rhsc(^) = (Mb x B) + {Me x C), where 


Mb 


Me 


1 


X 


rriB—dB—mc 


if ms < ds + me 
if ms > ds + me 


1 if ms > ds + me 

^dB+mc-rriB ifms<ds+mc- 


Note that the resulting circuit is powerful skew. □ 

Corollary 1. The compressed word problem for ZlZ is -reducible to PIT for pow¬ 

erful skew circuits over the ring 1i[x\. 

In the rest of this section we show that PIT for powerful skew circuits can be reduced 
in NC^ to CWP(Z i Z). By Proposition |2] it suffices to consider the univariate case. 

Lemma 6. Let u,v G B* be well-formed. Then w = uv is well-formed too and 
Pw{x) =Pu{x) +Pv{x). 

Lemma 7. Let u G B* be well-formed, n, m G N and let w = Then w is 

well-formed too andPw{x) = m • x" • Pu{x). 

Lemma 8. From a given powerful skew circuit C over the ring Z[x], one can compute 
in NC^ an SLP A over the alphabet B such that the following holds: 


— val(A) is well-formed and 

- Pva.i{k){x) = val(C). 
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Proof. Let C — (V, rhsc,^o)- The set of nonterminals of our SLP A contains V, a 
disjoint copy V' = {V \ A G V} of V, plus some auxiliary nonterminals. The start 
nonterminal is Aq. For every nonterminal A G L we will have PvaiA(v 4 )( 2 ;) = vale (A) 
and for every nonterminal A! G V we will have PvaUiA') {x) = —vale(A). We define 
the right-hand sides of A as follows: 

- If rhse(A) = b ■ x", then we set rhsA(A) = and rhsA(A') = 

- If rhse(A) = B + C, then we set rhsA(A) = BC and rhsA(A') = B'C The 
correctness of this step follows from Lemma|6] 

- If rhse (A) = B x C, where w.l.o.g. C is an input gate with rhse (C) = 5 • x", then 

we set rhsA(A) = and rhsA(A') = where we set B~^ = 

{B' Y for X > 1. The correctness of this step follows from Lemma|2] 

It follows by a straightforward induction that for every A G V, the strings valA(A) and 
valA(A') are well-formed. □ 

From Lemma|3and[^we directly obtain: 

Corollary 2. The compressed word problem for 1XL is equivalent w.rt. HfY-reductions 
to PIT for powerful skew circuits over the ring Z[x]. 

In exactly the same way we can show: 

Corollary 3. The compressed word problem for Z„ ih (n > 2) is equivalent w.r.t. 
-reductions to PIT for powerful skew circuits over the ring Z„[x]. 

6.4 Compressed word problems in coRNC^ 

In this section, we apply the results from the last section to find groups for which the 
compressed word problem belongs to coRNC^. Recall from Section l6^ that the only 
known examples of groups with a word problem in NC are groups G having a normal 
subgroup H such that (i) H is f.g. nilpotent and (ii) G/H is finite solvable. For wreath 
products we use the following lemma: 

Lemma 9. For every k > 1 and every finitely generated group G, CWP(G' I lA) is 
HC^-reducible to CWP(G' I Z). 

Proof The idea is similar to the proof of Proposition |2] Let G be generated by the fi¬ 
nite set B. Fix the generating set { 01 , 02 ,... , 0 ^} for if, where every oi generates 
a Z-copy. Then G ^ Z* is generated by the set A = 27 U { 01 , 02 ,... ,Ofc}. Let A 
be an SLP over the alphabet F U r~^. First, we compute in NC^ the number d — 
2(|val(A)| -P 1). Note that for all o^, 6^ G Z (1 < i < k) with |oi|, |6i| < |val(A)| we 
have: (oi,..., Ofc) = (&i,..., if and only if o-i ' = S*Li 

From our SLP A we construct a new SLP B by replacing every occurrence of at 
(resp., o”^) in a right-hand side by a new variable that produces a'^' (resp., a~‘^' ). 

This implies the following: If (/, (zi,..., Zk)) (resp., {h, z)) is the group element of 
CWP(G } Z^) (resp., CWP(G } Iff) represented by val(A) (resp., val(B)), then z = 
Sfci for all (xi,... ,Xfe) G 1^, f{x\,... ,Xk) = h{x), where x = 

Y!i=i ■ dl~^- It follows that val(A) = 1 in G ? Z^ if and only if val(B) = 1 in G ^ Z. 

□ 


16 


By Lemma[3and Lemma^the compressed word problem for a group (G x H) I Z" 
can be reduced in NC^ to the compressed word problems for the groups GI Z and HI Z 
Together with Theorem|2]and Corollary |2] and |3] we obtain the following result: 

Corollary 4. Let G be a finite direct product of copies ofL and hpfor primes p. Then, 
for every n>l, CWP(G I Z”) belong to coRNC^. 

It is not clear, whether in Corollary|4]we can replace G by an arbitrary hnitely generated 
abelian group. On the other hand, if we apply Theorem [T] instead of Theorem |2] we 
obtain: 

Corollary 5. Let G bef.g. abelian and let H bef.g. virtually abelian (i.e., H has afg. 
abelian subgroup of finite index). Then CWP(G I H) belongs to coRP. 

Proof. Let K < Tf be a f.g. abelian subgroup of hnite index m in H. Moreover, either 
K — I or K if for some k > 1. By Lemma 01 G"* I K is isomorphic to a sub¬ 
group of index m in G I H.lf the group A is a hnite index subgroup of the group B, 
then CWP(i3) is polynomial-time many-one reducible to CWP(A) iTTSl Theorem 4.4]. 
Hence, it suffices to show that CWP(G'" I K) belongs to coRP. Since G"* is hnitely 
generated abelian, it suffices to consider CWP(Z„ I K) (n > 2) and CWP(Z I K). The 
case if = 1 is clear. So, assume that K = if. By CorollarylH CWP(Z;Z^) belongs to 
coRNC. Moreover, by Theorem[T]and Corollary|3 CWP(Z„ ;Z^) belongs to coRP. □ 

Recall that for a subgroup ii of a group G, [H, H] denotes the commutator subgroup 
of G. It is the subgroup of G generated by all elements hih 2 hf^hf^ with hi, ^2 € H. 
It is well known that if iV is a normal subgroup of G, then also [N, A^] is a normal 
subgroup of G. Hence, one can consider the quotient group G/[N, iVj. The following 
result of Magnus ll20l has many applications in combinatorial group theory. 

Theorem 10 (Magnus embedding theorem). Let be a free group of rank k and let 

N be a normal subgroup of F^. Then Fk/[N, N\ <1^ I F^/N. 

Theorem 11. Let F^ be a free group of rank k and let N be a normal subgroup of F^ 
such that Fk/N is f.g. virtually abelian. Then CWP(L)c/[A'^, A'^j) belongs to coRNC^. 

Proof. By the Magnus embedding theorem, the group Fk / [A^, A^j embeds into the 
wreath product Z^ I (Fk/N). For the latter group, the compressed word problem be¬ 
longs to coRNC^ by Corollary 0] □ 

7 Open problems 

Our coRNC^ identity testing algorithm for powerful skew circuits only works for the 
coefficient rings Z and Ip with p prime. It is not clear how to extend it to Z„ with n 
composite. The Agrawal-Biswas identity testing algorithm also works for Z„ with n 
composite. But the problem is that the Fich-Tompa algorithm only works for polyno¬ 
mial rings over Ip with p prime. For equality testing for multi-dimensional straight-line 
programs it remains open whether a polynomial time algorithm exists. For the one¬ 
dimensional (string) case, a polynomial time algorithm exists. Here, it remains open, 
whether the equality problem is in NC. 
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